# Brave Software: bug bounty program on HackerOne

> Brave Software is a bug bounty program on HackerOne. Its critical reports have paid an average of $5,500 across 22 reports (HackerOne figures, November 7, 2026). It received 359 reports in the 90 days to November 7, 2026, about 9.7 per in-scope asset.

- **Company:** Brave Software
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/brave
- **Pays bounties:** yes
- **Submissions:** paused
- **Launched:** October 12, 2016
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/brave

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $5,500 | 22 |
| High | $893 | 93 |
| Medium | $188 | 237 |
| Low | $96 | 212 |

- Reports received in the last 90 days: 359 (about 9.7 per in-scope asset)
- Bounties paid in the last 90 days: $30,000
- Bounties paid in total: $160,000
- Researchers participating: 370
- Response efficiency: 99%
- First-response target: 3 days
- Triage target: 9 days
- Bounty target: 24 days
- Barriers: bounty amounts hidden; submissions paused

## Scope

As imported from HackerOne on November 7, 2026: 37 assets in scope (37 bounty-eligible), 5 out of scope. The policy page is the authority.

- `0x0d8775f648430679a709e98d2b0cb6250d2887ef` (OTHER): in scope, bounty-eligible, max severity critical
- `0x44fcfabfbe32024a01b778c025d70498382cced0` (OTHER): in scope, bounty-eligible, max severity critical
- `0x67fa2c06c9c6d4332f330e14a66bdf1873ef3d2b` (OTHER): in scope, bounty-eligible, max severity critical
- `0x7c31560552170ce96c4a7b018e93cddc19dc61b6` (OTHER): in scope, bounty-eligible, max severity critical
- `0xfbfa258b9028c7d4fc52ce28031469214d10daeb` (OTHER): in scope, bounty-eligible, max severity critical
- `account.brave.com` (URL): in scope, bounty-eligible, max severity critical
- `api-dashboard.search.brave.com` (URL): in scope, bounty-eligible, max severity critical
- `basicattentiontoken.org` (URL): in scope, bounty-eligible, max severity critical
- `Brave Browser Desktop` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Brave websites` (OTHER): in scope, bounty-eligible, max severity critical
- `brave.com` (URL): in scope, bounty-eligible, max severity critical
- `com.brave.browser` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.brave.browser_beta` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.brave.ios.browser` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `creators.basicattentiontoken.org` (URL): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/bat-balance` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/bat-client` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/bat-go` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/bat-ledger` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/bat-publisher` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://github.com/brave-intl/publishers` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://github.com/brave/*, https://github.com/brave-intl/*` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave/brave-core` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/brave/browser-ios` (URL): in scope, bounty-eligible, max severity critical
- `https://github.com/brave/vault-updater` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/debian64` (URL): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/dev/debian64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/dev/ubuntu64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/fedora64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/linux64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/mint64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/openSUSE64` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/osx` (URL): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/winia32` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `https://laptop-updates.brave.com/latest/winx64` (URL): in scope, bounty-eligible, max severity critical
- `search.brave.com` (URL): in scope, bounty-eligible, max severity critical
- `talk.brave.com` (URL): in scope, bounty-eligible, max severity critical
- `com.linkbubble.playstore` (GOOGLE_PLAY_APP_ID): out of scope, max severity none
- `https://github.com/brave/brave-ios` (SOURCE_CODE): out of scope, max severity none
- `https://github.com/brave/browser-laptop` (SOURCE_CODE): out of scope, max severity none
- and 2 more on the BugRater page

## Recent public accepted findings

- May 28, 2026: medium severity
- April 13, 2026: low severity
- October 15, 2025: high severity
- August 22, 2025: high severity

---

Generated November 8, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.